Hacker Blogs
Work in progress: 181,232 of 181,233 sites checked so far, more every week · updated 2 Nov 2026Missing a blog? Tell us

Top all-time · #3526

T

Tim Taubert

Personal blog · timtaubert.de/blogsecuritywebprogramming

Tim Taubert's personal blog at timtaubert.de covers security, web and programming. Since 2012, 22 different Hacker News readers have linked it 35 times, most often “TLS version intolerance”. The last post was in 2018, but the archive is still widely read.

Visit the blog
35mentions?
22HN people?
2012–2019first – last linked?
Links on Hacker News per year · peak 12 in 2017

Too few sampled comments (8) to say how often HN recommends it.?

Why HN links it

HN readers link Tim Taubert's posts on TLS and web security internals, including session tickets, TLS version intolerance, TLS 1.3 zero-RTT trade-offs, and building standalone clients from web code.

Summarised by Claude from a sample of 8 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.

Most-linked posts?

  1. TLS version intolerance
    4 people · 4 mentions · first linked 2016-09-30
  2. More Privacy, Less Latency – Improved Handshakes in TLS v1.3
    3 people · 4 mentions · first linked 2015-11-16
  3. The sad state of server-side TLS session resumption implementations
    3 people · 3 mentions · first linked 2014-11-17
  4. The future of session resumption – Forward secure PSK key agreement in TLS 1.3
    3 people · 3 mentions · first linked 2017-02-15
  5. Equivalence proofs with SAW – Exploring formal verification
    2 people · 2 mentions · first linked 2017-01-26
  6. /blog/2016/01/build-your-own-signal-desktop/
    2 people · 2 mentions · first linked 2016-11-02
  7. Using the WebCrypto API to generate .onion names for Tor hidden services
    2 people · 2 mentions · first linked 2014-11-03
  8. Verified binary multiplication for GHASH
    2 people · 2 mentions · first linked 2017-06-29
  9. Bitslicing, an Introduction – Data Orthogonalization for Cryptography
    2 people · 2 mentions · first linked 2018-08-15

What Hacker News says?

  1. tamalsaha001 · 2017-05-17
    Interestingly I was researching TLS forward secrecy. And the recommendation seems to be to disable tls tickets. https://timtaubert.de/blog/2014/11/the-sad-state-of-server-s...

    Comment linking /blog/2014/11/the-sad-state-of-server-side-tls-session-resumption-implementations/

    on “A startup’s Firebase bill suddenly increased from $25 to $1750 per month”
  2. ttaubert · 2015-11-17

    Submitted More Privacy, Less Latency – Improved Handshakes in TLS v1.3 as a story · 81 points

    HN discussion
  3. cbr · 2018-03-06
    They have a lot of trouble too: https://timtaubert.de/blog/2016/09/tls-version-intolerance/

    Comment linking /blog/2016/09/tls-version-intolerance/

    on “History of the browser user-agent string (2008)”
  4. zerognowl · 2016-10-02

    Submitted TLS version intolerance as a story · 76 points

    HN discussion
  5. tgragnato · 2017-03-30
    If you want to use a standalone app then you can achieve it using NW.js https://timtaubert.de/blog/2016/01/build-your-own-signal-des...

    Comment linking /blog/2016/01/build-your-own-signal-desktop/

    on “Voice Calls: Secure, Crystal-Clear, AI-Powered”
  6. humpt · 2014-11-01

    Submitted Keeping secrets with JavaScript – An Introduction to the WebCrypto API [video] as a story · 51 points

    HN discussion
  7. ergot · 2017-01-19Recommends
    For those wondering how to create your own custom Tor onion adress, look no further than: https://timtaubert.de/blog/2014/11/using-the-webcrypto-api-t... And for those who think Protonmail are the only service with a custom address, think again, because Facebook has one too: https://facebookcorewwwi.onion/ You can find a tonne more at this list: https://github.com/chris-barry/darkweb-everywhere/tree/maste... And sta…

    Comment linking /blog/2014/11/using-the-webcrypto-api-to-generate-onion-names-for-tor-hidden-services/

    on “Introducing ProtonMail's Tor hidden service”
  8. ttaubert · 2014-11-17

    Submitted The sad state of server-side TLS session resumption implementations as a story · 28 points

    HN discussion
  9. finnn · 2016-11-02
    It's just Javascript, you don't need Chrome to run it. eg[0] [0]: https://timtaubert.de/blog/2016/01/build-your-own-signal-des...

    Comment linking /blog/2016/01/build-your-own-signal-desktop/

    on “Signal and Giphy”
  10. ttaubert · 2014-10-27

    Submitted Deploying TLS the hard way as a story · 11 points

    HN discussion
  11. pfg · 2015-11-20Recommends
    Fair enough. TLS 1.3 might introduce a zero-RTT handshake (with some security trade-offs), but that's obviously going to take quite some time to get rolled out. Highly recommend this blog post [1] for more. [1]: https://timtaubert.de/blog/2015/11/more-privacy-less-latency...

    Comment linking /blog/2015/11/more-privacy-less-latency-improved-handshakes-in-tls-13/

    on “Domain-validated SSL will soon be free from the large CAs”
  12. ttaubert · 2014-11-03

    Submitted Using the WebCrypto API to generate .onion names for Tor hidden services as a story · 7 points

    HN discussion
  13. zaroth · 2017-09-28
    True, it does not destroy the entire purpose if and when the STEK is securely and properly rotated. But to call this PFS stretches the truth in ways that boring crypto never does. The number of real-world cases where PFS is reduced exactly to the non-PFS state by the existence of session tickets with fixed STEKs is not only non-zero, but rather I would venture a guess it is staggeringly large. E.g. Configuring Sessi…

    Comment linking /blog/2014/11/the-sad-state-of-server-side-tls-session-resumption-implementations/

    on “TLS 1.2 Session Tickets”
  14. robin_reala · 2018-08-15

    Submitted Bitslicing, an Introduction – Data Orthogonalization for Cryptography as a story · 5 points

    HN discussion
  15. StudentStuff · 2019-08-04
    > An increasing number of businesses are legitimately intercepting encrypted traffic on their networks. It’s pretty much a necessity today. This is blatant FUD right in the intro, trying to push F5's known bad TLS MITM hardware: https://timtaubert.de/blog/2016/09/tls-version-intolerance/

    Comment linking /blog/2016/09/tls-version-intolerance/

    on “Kazakhstan Attempts to MITM Its Citizens”
  16. crabasa · 2014-09-13

    Submitted Keeping Secrets with JavaScript – The WebCrypto API [video] as a story · 5 points

    HN discussion
  17. spaceboy · 2017-02-16

    Submitted The future of session resumption – Forward secure PSK key agreement in TLS 1.3 as a story · 4 points

    HN discussion
  18. vgnet · 2012-04-12

    Submitted Are we small yet? as a story · 4 points

    HN discussion
  19. okket · 2017-02-15

    Submitted The future of session resumption – Forward secure PSK key agreement in TLS 1.3 as a story · 3 points

    HN discussion
  20. harshal · 2013-05-06

    Submitted Working with infinite sequences in JavaScript [ES6] as a story · 3 points

    HN discussion
  21. ttaubert · 2018-08-28

    Submitted Bitslicing S-boxes with the Quine-McCluskey algorithm as a story · 2 points

    HN discussion
  22. spurlock · 2017-06-30

    Submitted Equivalence proofs with SAW – Exploring formal verification as a story · 2 points

    HN discussion
  23. ingve · 2017-06-30

    Submitted Verified binary multiplication for GHASH as a story · 2 points

    HN discussion
  24. ttaubert · 2017-06-29

    Submitted Verified binary multiplication for GHASH as a story · 2 points

    HN discussion
  25. ttaubert · 2017-02-07

    Submitted Simple Cryptol specifications – Exploring formal verification (part 2) as a story · 2 points

    HN discussion
  26. ttaubert · 2016-09-30

    Submitted TLS version intolerance – Working around bugs in legacy TLS stacks as a story · 2 points

    HN discussion
  27. iberinger · 2015-11-17

    Submitted More Privacy, Less Latency – Improved Handshakes in TLS Version 1.3 as a story · 2 points

    HN discussion
  28. ttaubert · 2015-11-16

    Submitted More Privacy, Less Latency – Improved Handshakes in TLS v1.3 as a story · 2 points

    HN discussion
  29. ttaubert · 2012-10-18

    Submitted Building an EyeToy-like mini-game with getUserMedia() as a story · 2 points

    HN discussion
  30. ttaubert · 2012-10-17

    Submitted Building a live green screen with getUserMedia() and MediaStreams as a story · 2 points

    HN discussion

Search all of HN for timtaubert.de

Linked by the same people?